In a previous PR I have added the tile entity request packet handler which checks for building permissions to prevent the unauthorized player to open a DisplayDoll and see its content.
This Handler is being added to prevent *Hackers* from modifying a DisplayDoll through direct/crafted packet sending, or by sending raw byte data to the server.
In a valid enviroment, the player couldn't even get to see the content of the doll in the first place, to then try to modify it's items.
Because of this, I do not bother with making sure the player gets their item back.